securityonion/salt/logstash/files/dynamic/9997_output_helix.conf

{% set HELIX_API_KEY = salt['pillar.get']('fireeye:helix:api_key', '') %}

filter {
  if [type] =~ /^bro_conn|bro_dns|bro_http|bro_files|bro_ssl|bro_dhcp|bro_x509$/ {
    grok {
      match => [
        "source_ip", "^%{IPV4:srcipv4}$",
        "source_ip",  "(?<srcipv6>^([0-9A-Fa-f]{0,4}:){2,7}([0-9A-Fa-f]{1,4}$|((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.|$)){4})$)"
        ]
    }
    grok {
      match => [
        "destination_ip",  "(?<dstipv6>^([0-9A-Fa-f]{0,4}:){2,7}([0-9A-Fa-f]{1,4}$|((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.|$)){4})$)",
        "destination_ip", "^%{IPV4:dstipv4}$"
       ]
    }

    geoip {
      source => "[source_ip]"
      target => "source_geo"
    }
    geoip {
      source => "[destination_ip]"
      target => "destination_geo"
    }
    mutate {
      #rename => { "%{[source_geo][country_code]}" => "srccountrycode" }
      #rename => { "%{[destination_geo][country_code]}" => "dstcountrycode" }
      rename => { "[beat_host][name]" => "sensor" }
      copy => { "sensor" => "rawmsghostname" }
      rename => { "message" => "rawmsg" }
      #rename => { "event_type" => "program" }
      copy => { "type" => "class" }
      copy => { "class" => "program"}
      rename => { "source_port" => "srcport" }
      rename => { "destination_port" => "dstport" }
      remove_field => ["source_ip", "destination_ip"]
      remove_field => ["sensorname", "sensor_name", "service", "source", "tags", "syslog-host"]
      remove_field => ["sensor_name", "source_ips", "ips", "destination_ips", "syslog-priority", "syslog-file_name", "syslog-facility"]
    }
    if "bro_conn" in [class] {
      mutate {
        #add_field => { "metaclass" => "connection" }
        rename => { "original_bytes" => "sentbytes" }
        rename => { "respond_bytes" => "rcvdbytes" }
        rename => { "connection_state" => "connstate" }
        rename => { "uid" => "connectionid" }
        rename => { "respond_packets" => "rcvdpackets" }
        rename => { "original_packets" => "sentpackets" }
        rename => { "respond_ip_bytes" => "rcvdipbytes" }
        rename => { "original_ip_bytes" => "sentipbytes" }
        rename => { "local_respond" => "local_resp" }
        rename => { "local_orig" => "localorig" }
        rename => { "missed_bytes" => "missingbytes" }
      }
    }
    if "bro_dns" in [class] {
      mutate{
        #add_field = { "metaclass" => "dns"}
        rename => { "answers" => "answer" }
        rename => { "query" => "domain" }
        rename => { "query_class" => "queryclass" }
        rename => { "query_class_name" => "queryclassname" }
        rename => { "query_type" => "querytype" }
        rename => { "query_type_name" => "querytypename" }
        rename => { "ra" => "recursionavailable" }
        rename => { "rd" => "recursiondesired" }
      }
    }
    if "bro_dhcp" in [class] {
      mutate{
        #add_field = { "metaclass" => "dhcp"}
        rename => { "message_types" => "direction" }
				rename => { "lease_time" => "duration" }
      }
    }
    if "bro_files" in [class] {
      mutate{
        #add_field = { "metaclass" => "dns"}
        rename => { "missing_bytes" => "missingbytes" }
        rename => { "fuid" => "fileid" }
        rename => { "uid" => "connectionid" }
      }
    }
    if "bro_http" in [class] {
      mutate{
        #add_field = { "metaclass" => "dns"}
        rename => { "virtual_host" => "hostname" }
        rename => { "status_code" => "statuscode" }
        rename => { "status_message" => "statusmsg" }
        rename => { "resp_mime_types" => "rcvdmimetype" }
        rename => { "resp_fuids" => "rcvdfileid" }
        rename => { "response_body_len" => "rcvdbodybytes" }
        rename => { "request_body_len" => "sentbodybytes" }
        rename => { "uid" => "connectionid" }
        rename => { "ts"=> "eventtime" }
	      rename => { "@timestamp"=> "eventtime" }
      }
    }
    if "bro_ssl" in [class] {
      mutate{
        #add_field = { "metaclass" => "dns"}
        rename => { "status_code" => "statuscode" }
        rename => { "status_message" => "statusmsg" }
        rename => { "resp_mime_types" => "rcvdmimetype" }
        rename => { "resp_fuids" => "rcvdfileid" }
        rename => { "response_body_len" => "rcvdbodybytes" }
        rename => { "request_body_len" => "sentbodybytes" }
      }
    }
		if "bro_weird" in [class] {
      mutate{
        #add_field = { "metaclass" => "dns"}
        rename => { "name" => "eventname" }
      }
    }
		if "bro_x509" in [class] {
      mutate{
        #add_field = { "metaclass" => "dns"}
				rename => { "certificate_common_name" => "certname" }
        rename => { "certificate_subject" => "certsubject" }
				rename => { "issuer_common_name" => "issuer" }
				rename => { "certificate_issuer" => "issuersubject" }
				rename => { "certificate_not_valid_before" => "issuetime" }
				rename => { "certificate_key_type" => "cert_type" }
      }
    }
  }
}

output {
  if [type] =~ /^bro_conn|bro_dns|bro_http|bro_files|bro_ssl|bro_dhcp|bro_x509$/ {
    http {
      url => "https://helix-integrations.cloud.aws.apps.fireeye.com/api/upload"
      http_method => post
      http_compression => true
      socket_timeout => 60
      headers => ["Authorization","{{ HELIX_API_KEY }}"]
      format => json_batch
    }
  }
}